Not sure I follow, can a non-root user observe raw packets (like SYN packets and... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

0x0 on Dec 9, 2014 | parent | context | favorite | on: Powerful, highly stealthy Linux trojan may have in...

Not sure I follow, can a non-root user observe raw packets (like SYN packets and sequence numbers) through these facilities?

Edit: well, a statically linked pcap is still just a bunch of user-mode assembly code. I didn't think linux kernel security hinged on keeping libraries secret :P

tedunangst on Dec 9, 2014 [–]

I tried interpreting the ars article (rookie mistake) and assumed it was stealing traffic from other programs running as the same user.

0x0 on Dec 9, 2014 | [–]

Aha, now I see why you brought up ptrace.

But they were talking about magic syn packets etc (in the securelist post linked from another comment, I got the sources mixed up)

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact